A SQL injection vulnerability in Krayin Laravel CRM allows authenticated attackers to manipulate database queries and potentially access sensitive information.

The application fails to properly neutralize special elements used in SQL commands (CWE-89) within the lead datagrid functionality. This allows an authenticated user to perform blind SQL injection by injecting malicious payloads into the rotten lead parameter.

Successful exploitation allows an attacker to extract sensitive data from the underlying database, bypass authentication, or modify application data. With a CVSS score of 8.8, this vulnerability represents a significant risk to the confidentiality and integrity of customer relationship data managed within the CRM.

Immediate Action: Update Krayin Laravel CRM to version 2.2.4 or later to remediate the SQL injection flaw.

Proactive Monitoring: Review database query logs for suspicious patterns, such as unexpected use of SQL keywords or syntax errors in query strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to block malicious requests targeting the vulnerable lead datagrid parameter.

Public Exploit Available: unknown

Given the existence of a proof-of-concept and the high severity of SQL injection, organizations should prioritize updating their CRM instances to version 2.2.4. Failure to patch may expose critical business data to unauthorized access.